The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsLearn about Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerabilities in an interactive lesson.
Start learningUpgrade Azure.Identity
to version 1.11.4 or higher.
Affected versions of this package are vulnerable to Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in the authentication process. An attacker can elevate privileges by exploiting race conditions during the token validation steps. This is only exploitable if the application is configured to use multiple threads or processes for handling authentication requests.
Notes:
An attacker who successfully exploited the vulnerability could elevate privileges and read any file on the file system with SYSTEM access permissions;
An attacker who successfully exploits this vulnerability can only obtain read access to the system files by exploiting this vulnerability. The attacker cannot perform write or delete operations on the files;
The vulnerability exists in the following credential types: DefaultAzureCredential
and ManagedIdentityCredential
;
The vulnerability exists in the following credential types:
ManagedIdentityApplication
(.NET)
ManagedIdentityApplication
(Java)
ManagedIdentityApplication
(Node.js)